6.2 Managing Dynamic Lists
6.2.1 Editing a Dynamic List
-
Launch the Sentinel Control Center. For more information, see Step 1 in Section 6.1.1, Using the Sentinel Control Center to Create a Dynamic List.
-
Launch the Dynamic Lists window:
-
(Conditional) If the menu is not enabled, click the tab, then click the menu > or click the
icon in the toolbar.
-
(Conditional) If the menu is enabled, click the menu > or click the
.icon in the toolbar.
-
-
In the Dynamic Lists window, select the dynamic list you want to edit, then click .
-
Make the necessary changes, then click .
The name cannot be changed.
NOTE:If you make changes to the transient life span on an active Dynamic List, the changes do not apply to elements already in the list. Elements that are already in the Dynamic List retain their original life span.
6.2.2 Deleting a Dynamic List
You can delete only the dynamic lists that are not being used by Correlation rules or actions:
-
Launch the Sentinel Control Center. For more information, see Step 1 in Section 6.1.1, Using the Sentinel Control Center to Create a Dynamic List.
-
Launch the Dynamic Lists window:
-
(Conditional) If the menu is not enabled, click the tab, then click the menu > or click the
icon in the toolbar.
-
(Conditional) If the menu is enabled, click the menu > or click the
.icon in the toolbar.
-
-
In the Dynamic Lists window, select the dynamic list you want to delete, then click .
-
Click to confirm deletion.
6.2.3 Removing Dynamic List Elements
There are several ways an element can be removed from a Dynamic List:
-
The element can be removed manually:
In the Dynamic List Properties window, select the element you want to delete, then click .
-
The element can be removed by a Correlation rule action.
-
The element‘s life span can expire.
-
If the maximum number of elements for a Dynamic List is reached, elements are removed from the list to keep the list at or below the maximum list size. The transient elements are removed from oldest to newest before any persistent elements are removed.